Winsock32...problem or not?

[dg76]

Oh, and also when I type in msconfig and go to services, there is an instance of winsock32. It is stopped and not running, but it remains there.

[jholland1964]

Oh, and also when I type in msconfig and go to services, there is an instance of winsock32. It is stopped and not running, but it remains there.

That is not where you see if it is running. Most disabled items remain in msconfig. That is not a problem.
Go to taskmanger and see...ctrl-alt-delete will get you there.
We need to see the actual original ewido log.
The entry in the HJT log just means that it is set by XP services to run on start up.
You can remove these one of three ways;
There are several ways you can use to delete the service key:

1. Delete it using XP's SC command you would type the following from a command prompt:
   
   sc delete winsock32

2. Use HijackThis to delete the service. You can click on Config, then Misc Tools, and then press the Delete an NT service.. button. When it opens you should then enter the service name and press OK.

[PhilliePhan]

2. Use HijackThis to delete the service. You can click on Config, then Misc Tools, and then press the Delete an NT service.. button. When it opens you should then enter the service name and press OK.

This is the better option.

This baddie adds values to 8 or 9 registry keys as well as modifies the Hosts file.

A complete removal would have to address those issues. There should be a good Sophos writeup to guide you.

Cheers
PP